CVE-2022-31099None▾ SunlitStack overflow during recursive expression parsing
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0.2 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Oct 13.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
0.9%
0.9% → 1.0%
When parsing untrusted rulex expressions, the stack may overflow, possibly enabling a Denial of Service attack. This happens when parsing an expression with several hundred levels of nesting, causing the process to abort immediately.
The flaw was corrected in commits 60aa2dc03a by adding a check to recursion
depth.
rulex >= 0.0.0-0, < 0.4.3Upgrade to a patched release:
rulex 0.4.3Connected by shared product, vendor, weakness, or advisory.